Detections
Analytics
Adobe AIR < 2.5.1 Multiple Vulnerabilities (APSB10-26)
high Nessus Plugin ID 50604
Language:
Synopsis
The remote Windows host contains a version of Adobe AIR that is affected by multiple vulnerabilities.Description
The remote Windows host contains a version of Adobe AIR that is earlier than 2.5.1. Such versions are affected by multiple vulnerabilities:- An error exists in the validation of input and, with certain server encodings, lead to a violation of cross- domain policy file restrictions. (CVE-2010-3636)
- An unspecified error exists which can lead to a denial of service. (CVE-2010-3639)
- An error exists in the library loading logic and can lead to arbitrary code execution. (CVE-2010-3976)
- There exist multiple memory corruption vulnerabilities which can lead to arbitrary code execution.
(CVE-2010-3637, CVE-2010-3640, CVE-2010-3641, CVE-2010-3642, CVE-2010-3643, CVE-2010-3644, CVE-2010-3645, CVE-2010-3646, CVE-2010-3647, CVE-2010-3648, CVE-2010-3649, CVE-2010-3650, CVE-2010-3652, CVE-2010-3654)
Solution
Upgrade to Adobe AIR 2.5.1 or later.See Also
http://www.adobe.com/support/security/bulletins/apsb10-26.html
Plugin Details
Severity: High
ID: 50604
File Name: adobe_air_apsb10-26.nasl
Version: 1.14
Type: local
Agent: windows
Family: Windows
Published: 11/15/2010
Updated: 4/11/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Critical
Score: 9.6
CVSS v2
Risk Factor: High
Base Score: 9.3
Temporal Score: 8.1
Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C
Vulnerability Information
CPE: cpe:/a:adobe:air
Required KB Items: SMB/Adobe_AIR/Version, SMB/Adobe_AIR/Path
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 11/4/2010
Vulnerability Publication Date: 9/10/2010
Exploitable With
CANVAS (CANVAS)
Core Impact
Metasploit (Adobe Flash Player "Button" Remote Code Execution)
Reference Information
CVE: CVE-2010-3636, CVE-2010-3637, CVE-2010-3639, CVE-2010-3640, CVE-2010-3641, CVE-2010-3642, CVE-2010-3643, CVE-2010-3644, CVE-2010-3645, CVE-2010-3646, CVE-2010-3647, CVE-2010-3648, CVE-2010-3649, CVE-2010-3650, CVE-2010-3652, CVE-2010-3654, CVE-2010-3976
BID: 44504, 44671, 44675, 44677, 44678, 44679, 44680, 44681, 44682, 44683, 44684, 44685, 44686, 44687, 44690, 44691, 44692